REMARKS 

The enclosed is responsive to the Examiner's Office Action mailed on 
March 17, 2008. At the time the Examiner mailed the Office Action claims 1-20 
were pending. By way of the present response the Applicants have: 1) amended 
claims 1, 12, 13, and 17-20; 2) added no new claims; and 3) no canceled claims. 
As such, claims 1-20 are now pending. The Applicants respectfully request 
reconsideration of the present application and the allowance of all claims now 
represented. 

Claim Rejections 

35 U.S.C. 101 Rejections 

Claims 1-11 and 17-20 were rejected under 35 U.S.C. §101 as being 
''directed to non-statutory subject matter." 

With respect to claim 1, Applicants respectfully submit that a hardware 
component is included in the claim. Specifically, "a network interface module to 
connect the apparatus to a network" is a hardware component. Thus, claim 1 is 
directed to statutory subject matter. Claims 2-11 are dependent on claim 1 and 
are also directed to statutory subject matter. 

With respect to claim 17, while Applicants respectfully disagree that the 
preamble of claim 17 was not limited to storage media, Applicants have 
amended the claim in a non-narrowing manner similar to what the Office Action 
suggested on page 3. Applicants respectfully submit that claim 17 and its 
dependents 18-20 are directed toward patentable subject matter. 

35 U.S.C. 102(e) Rejections 
Claims 1-7 and 9 stand rejected under 35 U.S.C. 102(e) as being 
anticipated by U.S. Patent 7,277,957 B2 (hereinafter "Rowley"). Rowley 
describes a method for recreating a "network communication session." Rowley, 
col.4 1.39. The method begins with packets being captured. Rowley, col. 3 11.28- 
42. They are "then sorted into a protocol list" and decoded according to the 
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protocol. Rowley, col.3 11.49-56. Finally, the network communication session is 
recreated. Rowley, col. 4 1.39. 

Rowley does not describe what Applicants claims require. With respect 
to claim 1, Rowley does not describe: 

a network interface module to connect the 
apparatus to a network; 

a packet capture module to intercept 
packets being transmitted on the network; 

an object assembly module to reconstruct 
flows representing objects being transmitted on 
the network from the intercepted packets; 

an object classification module to 
determine a type of content and reconstruct 
objects from the flows; 

an object store module to store the objects ; 

and 

a user interface to enable a user to search 
objects stored in the object store module . 

Rowley does not describe any module to "determine a type of content of 
the reconstructed objects/' The Office Action cites two portions of Rowley as 
purportedly describing this limitation. Rowley does describe determining if a 
packet indicates a script file, but does not determine the type of content (such as 
Word, PDF, etc.). Rowley merely looks at protocols by port number (see Fig. 3) 
and does not classify by type by using the inherent properties and signatures of 
various documents to determine the content type of each object. 

As such, Rowley does not describe the final limitations because Rowley 
does not recreate objects reconstructed in the claimed manner. 

Accordingly, Rowley does ncit describe what claim 1 requires. Claims 2- 
11 are dependent on claim 1 and are allowable for at least the same reason. 

35 U.S.C. 103(a) Rejections 
Claim 8 stands rejected under 35 U.S.C. 103(a) as being unpatentable 
over Rowley and further in view of U.S. Patent 7,072,967 Bl (hereinafter 
"Saulpaugh"). Claim 8 is dependent on claim 1 and is thus allowable for at least 
the same rationale. 
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Claims 10-11 stand rejected under 35 U.S.C. 103(a) as being unpatentable 
over Rowley and further in view of U.S. Patent 7,290,048 Bl (hereinafter 
"Barnett"). Claims 10-11 are dependent on claim 1 and are thus allowable for at 
least the same rationale. 

Claims 12-14 and 17-19 stand rejected under 35 U.S.C. 103(a) as being 
unpatentable over Rowley in view of Barnett. Barnett describes the creation of 
spreadsheets with "network-based data" consisting of a "time series of values 
(rows)." Barnett, Abstract and col.10 11.52-53. These rows include time stamp 
data, source and destination address, etc. Barnett, col.10 11.52-61. They may 
also include "tags" which "contain annotations which help support transaction 
recognition, pointers to original sources of data for traceability, and color coding 
tags for display purposes." Barnett, col.10 11.52-53. These "tags" do not index 
objects stored. 

The combination of Rowley and Barnett does not describe: 

intercepting data being transmitted on a 
network; 

reconstructing flows of objects being 
transmitted on the network from the intercepted 
data; 

classifying the reconstructed objects by 
content type; 

creating a tag to describe each 
reconstructed object; 

storing the classified objects and tags ; and 

indexing the stored objects to enable 
searching of the stored objects via the tags . 

First, Rowley does not describe any module to "classify by type." The 
Office Action cites two portions of Rowley as purportedly describing this 
limitation. Rowley does describe determining if a packet indicates a script file, 
but does not determine the type of content (such as Word, PDF, etc.). Rowley 
merely looks at protocols by port number (see Fig. 3) and does not classify by 
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type by using the inherent properties and signatures of various documents to 
determine the content type of each object. 

Neither reference describes "creating a tag to describe each 
reconstructed object" or storing such a tag. 

Finally, while Barnett was cited as indexing stored objects, Barnett does 
not 1) store recreated objects and 2) does not index stored recreated objects. 
Rather, Barnett points to "original sources of data " 

Thus, the combination does not describe what Applicants claims 12 and 
17 require. Claims 13-16 and 18-20 are dependent on claims 12 and 17 
respectively and are allowable for at least the same reason. 

Claims 15-16 and 20 stand rejected under 35 U.S.C. 103(a) as being 
unpatentable over Rowley, Barnett and further in view of Saulpaugh. Claims 15- 
16 are dependent on claim 12 are allowable for at least the same rationale. 
Claim 20 is dependent on claim 17 and allowable for at least the same reason. 

In light of the comments above, the Applicants respectfully request the 
allowance of all claims. 
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CONCLUSION 



Applicants respectfully submit that all rejections have been overcome 
and that all pending claims are in condition for allowance. 

If there are any additional charges, please charge them to our Deposit 
Account Number 02-2666. If a telephone conference would facilitate the 
prosecution of this application, the Examiner is invited to contact David F. 
Nicholson at (408) 720-8300. 



Respectfully submitted, 

BLAKELY, SOKOLOFF, TAYLOR & ZAFMAN LLP 





David F. Nicholson 
Reg. No.: 62,888 



1279 Oakmead Parkway 
Sunnyvale, CA 94085 
(408) 720-8300 
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